best-practices

SKILL.md

Modern web development standards covering security, compatibility, and code quality patterns.

Enforces HTTPS, Content Security Policy, and security headers to prevent XSS, clickjacking, and mixed-content vulnerabilities

Addresses browser compatibility through proper doctype, charset, viewport configuration, and feature detection instead of user-agent sniffing

Covers deprecated APIs (document.write, synchronous XHR, Application Cache) with modern replacements (dynamic script loading, fetch, Service Workers)

Includes code quality checks: valid HTML, semantic markup, error handling, memory cleanup, and passive event listeners for performance

Provides an audit checklist and tools (npm audit, SecurityHeaders.com, W3C Validator, Lighthouse) for systematic best-practices validation

Best practices

Modern web development standards based on Lighthouse best practices audits. Covers security, browser compatibility, and code quality patterns.

Security

HTTPS everywhere

Enforce HTTPS:

<!-- ❌ Mixed content -->
<img src="http://example.com/image.jpg">
<script src="http://cdn.example.com/script.js"></script>

<!-- ✅ HTTPS only -->
<img src="https://example.com/image.jpg">
<script src="https://cdn.example.com/script.js"></script>